From 04889e646cc83865ac1da1cdfc42e5a956c2cf30 Mon Sep 17 00:00:00 2001 From: yokai Date: Tue, 4 Aug 2026 16:31:11 -0500 Subject: kusanagi/ollama: expose service on wifi LAN Bind Ollama on all interfaces but open its API only on kusanagi's Wi-Fi interface, so LAN clients can reach it without relying on Tailscale exposure. Remove the blanket tailscale0 trust from the shared firewall so tailnet traffic follows explicit host firewall rules instead of inheriting access to every listening service. Assisted-by: OpenAI:gpt-5 --- common/core.nix | 4 ++-- machines/kusanagi/default.nix | 5 +++++ 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/common/core.nix b/common/core.nix index 5d36646..9e9ca7a 100644 --- a/common/core.nix +++ b/common/core.nix @@ -16,8 +16,8 @@ # Enable networking networking.networkmanager.enable = true; - # for tailscale - networking.firewall.trustedInterfaces = [ "tailscale0" ]; + # for tailscale; open only its discovery/connection UDP port and let the + # normal host firewall rules apply to tailnet traffic too. networking.firewall.allowedUDPPorts = [ 41641 ]; services.tailscale.enable = true; diff --git a/machines/kusanagi/default.nix b/machines/kusanagi/default.nix index 1c8ccb1..a1d4610 100644 --- a/machines/kusanagi/default.nix +++ b/machines/kusanagi/default.nix @@ -19,6 +19,10 @@ networking.hostName = "kusanagi"; + # Ollama is served on the Wi-Fi LAN only. Tailscale remains governed by ACLs + # plus the host firewall because tailscale0 is not a trusted interface. + networking.firewall.interfaces.wlp8s0.allowedTCPPorts = [ 11434 ]; + # This value determines the NixOS release from which the default # settings for stateful data, like file locations and database versions # on your system were taken. It‘s perfectly fine and recommended to leave @@ -219,6 +223,7 @@ services.ollama = { enable = true; package = pkgs.ollama-rocm; + host = "0.0.0.0"; environmentVariables = { # No HIP_VISIBLE_DEVICES / HSA_OVERRIDE_GFX_VERSION: the 7900 XT is # native gfx1100 and discovery excludes the unsupported Raphael iGPU -- cgit v1.3